● Covered by 4 sources · 4 reportsHigh impact1 negative3 neutral
Azure Cosmos DB Vulnerability "CosmosEscape" Allowed Access to All Databases
Key points
- Wiz Research found "CosmosEscape" in Azure Cosmos DB's Gremlin API.
- Vulnerability allowed full read/write access to all databases, including Microsoft's.
- Attackers could obtain a "Cosmos Master Key" to retrieve account primary keys.
- Microsoft remediated the issue, eliminating the platform-wide key.
- No customer data was accessed outside of researcher testing.
Critical Flaw Discovered in Azure Cosmos DB
Cybersecurity firm Wiz Research identified a critical vulnerability, dubbed "CosmosEscape," in Azure Cosmos DB, Microsoft's flagship database service. The flaw, found in the Gremlin API, could have allowed an attacker to gain full read and write access to every database on the service.
This vulnerability potentially exposed not only customer databases but also Microsoft's own internal databases, which are used by services such as Microsoft Entra ID, Microsoft Teams, and Microsoft Copilot.
How "CosmosEscape" Worked
The exploit chain began with a crafted query against a Gremlin database controlled by the attacker. Cosmos DB compiled Gremlin queries into .NET code, but restrictions meant to keep operations within the Gremlin sandbox were insufficient, allowing for code execution on the multi-tenant DB Gateway.
This execution exposed what Wiz called the "Cosmos Master Key," a platform-wide secret. This key granted two capabilities: retrieving the primary key of any Cosmos DB account for full read and write access, and enumerating all databases on the service, filterable by subscription and tenant IDs. Chained together, these capabilities could have enabled targeted compromises at a platform scale from publicly accessible endpoints.
Microsoft's Remediation and Impact
Microsoft blocked the vulnerable Gremlin entry point within 48 hours of Wiz's report in November 2025. The company completed the longer-term fix across all regions in July 2026, which included eliminating the platform-wide key and adding new guardrails to prevent similar attacks.
Microsoft's review found no unauthorized activity outside of the researchers' testing. No customer data was accessed, and no customer action is required. The incident highlights the challenges in removing global secrets from live multi-tenant systems.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
How outlets covered it
Wiz Research disclosed CosmosEscape, a vulnerability chain in Azure Cosmos DB that allowed read and write access to all databases on the service. Microsoft has fully remediated the issue, and no customer action is required, but the incident highlights challenges in removing global secrets from multi-tenant systems.
Cybersecurity firm Wiz discovered a critical vulnerability, dubbed CosmosEscape, in Azure Cosmos DB that could have allowed attackers to gain full read and write access to all databases on the service. This flaw potentially exposed Microsoft's own databases, including those used by Entra ID, Teams, and Copilot, to unauthorized access.
A vulnerability in Azure Cosmos DB, dubbed CosmosEscape, allowed attackers to gain full read and write access to databases across customer tenants by escaping the Gremlin query sandbox. Microsoft patched the vulnerability, which was reported by Wiz, and stated no customer data was accessed outside of the researchers' testing.
Wiz Research identified "CosmosEscape," a critical vulnerability in Azure Cosmos DB's Gremlin API that could have allowed attackers to compromise all databases within the service, including Microsoft's internal databases. Microsoft has fully remediated the issue, eliminating the "Cosmos Master Key" and adding new guardrails to prevent similar attacks.